MODX Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2014-8775)

Description

MODX Revolution 2.x before 2.2.15 does not include the HTTPOnly flag in a Set-Cookie header for the session cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie.

Remediation

References

CVE-2014-8775

Related Vulnerabilities

MySQL CVE-2013-3793 Vulnerability (CVE-2013-3793)

WordPress Plugin Catch Themes Demo Import Security Bypass (1.5)

Apache Tomcat Permissions, Privileges, and Access Controls Vulnerability (CVE-2011-3190)

Rukovoditel Unrestricted Upload of File with Dangerous Type Vulnerability (CVE-2020-11817)

WordPress Plugin wpForo Forum SQL Injection (1.4.9)

Severity

Medium

Classification

CVE-2014-8775 CWE-200